CVE-2026-93195

What it actually does

Missing unregistration of the DisplayPort AUX channel adapter during driver unbind in the dw-dp DRM bridge driver allows resource leaks and use-after-free conditions when the driver is detached.

Why it matters to the business

Kernel instability, crashes, or potential local privilege escalation on Linux systems using Synopsys DesignWare DisplayPort hardware, leading to downtime for graphical workloads and increased patching urgency.

How an attack unfolds

An attacker with local access triggers repeated bind and unbind operations on the dw-dp driver, such as through module reloads or display hot-plug events, leaving a dangling AUX adapter reference that is later dereferenced to achieve use-after-free.

How to fix it

Apply the upstream kernel commit that introduces dw_dp_unbind to unregister the AUX adapter on driver detachment; rebuild and deploy the updated kernel image.

How to confirm the fix worked

Confirm the dw_dp_unbind function exists and calls drm_dp_aux_unregister during unbind; test bind/unbind cycles under memory debugging tools such as KASAN to verify absence of use-after-free reports.

Typical attack path

1. Obtain local access on a vulnerable Linux system
2. Trigger dw_dp_bind to register the AUX adapter
3. Force driver unbind without calling the missing cleanup routine
4. Reuse the freed AUX adapter structure to corrupt kernel memory

How to detect it

Review kernel logs and dmesg for oops, warnings, or KASAN reports referencing dw_dp, AUX adapter, or drm_dp_aux; correlate with module load/unload or hotplug events.

• dw_dp_bind
• dw_dp_unbind
• drm_dp_aux_unregister
• use-after-free.*dw-dp

What your security team should do

• Prioritize kernel updates containing the dw-dp AUX unregistration fix across all affected fleets
• Enable kernel hardening features such as KASAN and lockdown mode until patches are applied
• Restrict unprivileged local access and module loading on systems exposing the vulnerable driver